@honua/mcp-server 0.1.2-beta.0 → 0.1.8-beta.0

package/dist/src/release/zero-to-map-provision.d.ts

@@ -0,0 +1,37 @@
+export declare const AWS_ECS_PROVISION_BINDING_SCHEMA: "honua.aws-ecs.provision-binding/v1";
+export declare const ZERO_TO_MAP_ACCESS_GRANTS: readonly ["admin:read", "admin:write"];
+export interface ProvisionedAccessCredentialReceipt {
+    readonly id: string;
+    readonly requestedGrants: readonly string[];
+    readonly effectiveGrants: readonly string[];
+    readonly status: "active";
+    readonly canAuthenticate: true;
+    readonly referenceType: "aws-secrets-manager";
+    readonly referenceDigestSha256: string;
+}
+export interface AwsEcsProvisionBinding {
+    readonly schemaVersion: typeof AWS_ECS_PROVISION_BINDING_SCHEMA;
+    readonly target: "aws-ecs";
+    readonly status: "ready";
+    readonly candidateId: string;
+    readonly releaseId: string;
+    readonly endpoint: string;
+    readonly adminKeySecretRef: string;
+    readonly accessCredential: ProvisionedAccessCredentialReceipt;
+    readonly serverImage: string;
+    readonly components: Readonly<Record<"honua-server" | "honua-devops" | "honua-iac", string>>;
+    readonly checks: Readonly<Record<"terraform-plan" | "terraform-apply" | "readiness" | "admin-mcp-handoff", "passed">>;
+    readonly evidence: {
+        readonly url: string;
+        readonly sha256: string;
+    };
+}
+/** Strictly parse the producer-owned pre-teardown binding without importing a second provisioner. */
+export declare function parseAwsEcsProvisionBinding(value: unknown): AwsEcsProvisionBinding;
+export declare function assertAwsEcsProvisionBindings(binding: AwsEcsProvisionBinding, expected: {
+    readonly candidateId: string;
+    readonly releaseId: string;
+    readonly mcpUrl: string;
+}): void;
+export declare function publicHttps(value: unknown, path: string): string;
+//# sourceMappingURL=zero-to-map-provision.d.ts.map

package/dist/src/release/zero-to-map-provision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zero-to-map-provision.d.ts","sourceRoot":"","sources":["../../../src/release/zero-to-map-provision.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,gCAAgC,EAAG,oCAA6C,CAAC;AAC9F,eAAO,MAAM,yBAAyB,wCAAyC,CAAC;AAEhF,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;CACxC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,aAAa,EAAE,OAAO,gCAAgC,CAAC;IAChE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,gBAAgB,EAAE,kCAAkC,CAAC;IAC9D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,GAAG,cAAc,GAAG,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7F,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,gBAAgB,GAAG,iBAAiB,GAAG,WAAW,GAAG,mBAAmB,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtH,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED,qGAAqG;AACrG,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,sBAAsB,CAkIlF;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,sBAAsB,EAC/B,QAAQ,EAAE;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9F,IAAI,CAON;AAWD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CA2BhE"}

package/dist/src/release/zero-to-map-provision.js

@@ -0,0 +1,177 @@
+import { createHash } from "node:crypto";
+export const AWS_ECS_PROVISION_BINDING_SCHEMA = "honua.aws-ecs.provision-binding/v1";
+export const ZERO_TO_MAP_ACCESS_GRANTS = ["admin:read", "admin:write"];
+/** Strictly parse the producer-owned pre-teardown binding without importing a second provisioner. */
+export function parseAwsEcsProvisionBinding(value) {
+    const binding = object(value, "AWS ECS provision binding");
+    exactKeys(binding, [
+        "schemaVersion",
+        "target",
+        "status",
+        "candidateId",
+        "releaseId",
+        "endpoint",
+        "adminKeySecretRef",
+        "accessCredential",
+        "serverImage",
+        "components",
+        "checks",
+        "evidence",
+    ], "AWS ECS provision binding");
+    if (binding.schemaVersion !== AWS_ECS_PROVISION_BINDING_SCHEMA) {
+        throw new Error(`AWS ECS provision binding schemaVersion must be ${AWS_ECS_PROVISION_BINDING_SCHEMA}`);
+    }
+    if (binding.target !== "aws-ecs" || binding.status !== "ready") {
+        throw new Error("AWS ECS provision binding must target aws-ecs with ready status");
+    }
+    const candidateId = pattern(binding.candidateId, /^manifest-sha256:[0-9a-f]{64}$/, "AWS ECS provision binding candidateId");
+    const releaseId = text(binding.releaseId, "AWS ECS provision binding releaseId");
+    const endpoint = publicHttps(binding.endpoint, "AWS ECS provision binding endpoint");
+    const adminKeySecretRef = pattern(binding.adminKeySecretRef, /^arn:aws(?:-us-gov|-cn)?:secretsmanager:[a-z0-9-]+:[0-9]{12}:secret:[A-Za-z0-9/_+=.@-]+$/, "AWS ECS provision binding adminKeySecretRef");
+    const accessCredential = object(binding.accessCredential, "AWS ECS provision binding accessCredential");
+    exactKeys(accessCredential, ["id", "requestedGrants", "effectiveGrants", "status", "canAuthenticate", "referenceType", "referenceDigestSha256"], "AWS ECS provision binding accessCredential");
+    const requestedGrants = stringList(accessCredential.requestedGrants, "AWS ECS provision binding accessCredential.requestedGrants");
+    const effectiveGrants = stringList(accessCredential.effectiveGrants, "AWS ECS provision binding accessCredential.effectiveGrants");
+    if (!sameStrings(requestedGrants, effectiveGrants)) {
+        throw new Error("AWS ECS provision binding requested and effective grants must match");
+    }
+    if (!sameStrings(requestedGrants, ZERO_TO_MAP_ACCESS_GRANTS)) {
+        throw new Error("AWS ECS provision binding access credential is not scoped to the required release grants");
+    }
+    if (accessCredential.status !== "active" || accessCredential.canAuthenticate !== true) {
+        throw new Error("AWS ECS provision binding access credential must be active and able to authenticate");
+    }
+    if (accessCredential.referenceType !== "aws-secrets-manager") {
+        throw new Error("AWS ECS provision binding access credential referenceType must be aws-secrets-manager");
+    }
+    const referenceDigestSha256 = pattern(accessCredential.referenceDigestSha256, /^[0-9a-f]{64}$/, "AWS ECS provision binding accessCredential.referenceDigestSha256");
+    const expectedReferenceDigest = createHash("sha256").update(adminKeySecretRef, "utf8").digest("hex");
+    if (referenceDigestSha256 !== expectedReferenceDigest) {
+        throw new Error("AWS ECS provision binding access credential reference digest does not match its secret reference");
+    }
+    const serverImage = pattern(binding.serverImage, /^ghcr\.io\/honua-io\/honua-server:[^@]+@sha256:[0-9a-f]{64}$/, "AWS ECS provision binding serverImage");
+    const components = object(binding.components, "AWS ECS provision binding components");
+    exactKeys(components, ["honua-server", "honua-devops", "honua-iac"], "AWS ECS provision binding components");
+    const checks = object(binding.checks, "AWS ECS provision binding checks");
+    exactKeys(checks, ["terraform-plan", "terraform-apply", "readiness", "admin-mcp-handoff"], "AWS ECS provision binding checks");
+    for (const name of ["terraform-plan", "terraform-apply", "readiness", "admin-mcp-handoff"]) {
+        if (checks[name] !== "passed")
+            throw new Error(`AWS ECS provision binding check ${name} must be passed`);
+    }
+    const evidence = object(binding.evidence, "AWS ECS provision binding evidence");
+    exactKeys(evidence, ["url", "sha256"], "AWS ECS provision binding evidence");
+    return {
+        schemaVersion: AWS_ECS_PROVISION_BINDING_SCHEMA,
+        target: "aws-ecs",
+        status: "ready",
+        candidateId,
+        releaseId,
+        endpoint,
+        adminKeySecretRef,
+        accessCredential: {
+            id: pattern(accessCredential.id, /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i, "AWS ECS provision binding accessCredential.id"),
+            requestedGrants,
+            effectiveGrants,
+            status: "active",
+            canAuthenticate: true,
+            referenceType: "aws-secrets-manager",
+            referenceDigestSha256,
+        },
+        serverImage,
+        components: {
+            "honua-server": revision(components["honua-server"], "AWS ECS provision binding honua-server SHA"),
+            "honua-devops": revision(components["honua-devops"], "AWS ECS provision binding honua-devops SHA"),
+            "honua-iac": revision(components["honua-iac"], "AWS ECS provision binding honua-iac SHA"),
+        },
+        checks: {
+            "terraform-plan": "passed",
+            "terraform-apply": "passed",
+            readiness: "passed",
+            "admin-mcp-handoff": "passed",
+        },
+        evidence: {
+            url: publicHttps(evidence.url, "AWS ECS provision binding evidence.url"),
+            sha256: pattern(evidence.sha256, /^[0-9a-f]{64}$/, "AWS ECS provision binding evidence.sha256"),
+        },
+    };
+}
+export function assertAwsEcsProvisionBindings(binding, expected) {
+    if (binding.candidateId !== expected.candidateId)
+        throw new Error("AWS ECS provision candidateId mismatch");
+    if (binding.releaseId !== expected.releaseId)
+        throw new Error("AWS ECS provision releaseId mismatch");
+    const expectedMcp = `${binding.endpoint.replace(/\/$/, "")}/mcp`;
+    if (normalizeUrl(expected.mcpUrl) !== normalizeUrl(expectedMcp)) {
+        throw new Error("AWS ECS provision endpoint does not match --mcp-url");
+    }
+}
+function normalizeUrl(value) {
+    const url = new URL(value);
+    if (url.protocol !== "https:" || url.username || url.password || !url.hostname) {
+        throw new Error("AWS ECS --mcp-url must be a public HTTPS URL without credentials");
+    }
+    url.hash = "";
+    return url.toString().replace(/\/$/, "");
+}
+export function publicHttps(value, path) {
+    const result = text(value, path);
+    const url = new URL(result);
+    if (url.protocol !== "https:" || url.username || url.password || !url.hostname) {
+        throw new Error(`${path} must be a public HTTPS URL without credentials`);
+    }
+    const host = url.hostname
+        .toLowerCase()
+        .replace(/^\[|\]$/g, "")
+        .replace(/\.$/, "");
+    if (host === "localhost" ||
+        host.endsWith(".localhost") ||
+        host.endsWith(".local") ||
+        host === "0.0.0.0" ||
+        host === "::1" ||
+        host.startsWith("127.") ||
+        host.startsWith("10.") ||
+        host.startsWith("169.254.") ||
+        host.startsWith("192.168.") ||
+        /^172\.(?:1[6-9]|2[0-9]|3[01])\./.test(host) ||
+        /^(?:fc|fd)[0-9a-f]{2}:/.test(host) ||
+        /^fe[89ab][0-9a-f]:/.test(host)) {
+        throw new Error(`${path} must not use a loopback or private endpoint`);
+    }
+    return result;
+}
+function object(value, path) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error(`${path} must be an object`);
+    return value;
+}
+function exactKeys(value, allowed, path) {
+    const keys = Object.keys(value);
+    const missing = allowed.filter((key) => !keys.includes(key));
+    const extras = keys.filter((key) => !allowed.includes(key));
+    if (missing.length > 0 || extras.length > 0) {
+        throw new Error(`${path} fields are not exact (missing: ${missing.join(", ") || "none"}; extra: ${extras.join(", ") || "none"})`);
+    }
+}
+function text(value, path) {
+    if (typeof value !== "string" || !value)
+        throw new Error(`${path} must be a non-empty string`);
+    return value;
+}
+function pattern(value, regex, path) {
+    const result = text(value, path);
+    if (!regex.test(result))
+        throw new Error(`${path} has an invalid format`);
+    return result;
+}
+function revision(value, path) {
+    return pattern(value, /^[0-9a-f]{40}$/, path);
+}
+function stringList(value, path) {
+    if (!Array.isArray(value) || value.length === 0 || value.some((item) => typeof item !== "string" || !item)) {
+        throw new Error(`${path} must be a non-empty string array`);
+    }
+    return value;
+}
+function sameStrings(left, right) {
+    return [...new Set(left)].sort().join("\n") === [...new Set(right)].sort().join("\n");
+}

package/dist/src/release/zero-to-map.d.ts

@@ -0,0 +1,296 @@
+export declare const ZERO_TO_MAP_PLAN_SCHEMA: "honua.zero-to-map.plan/v1";
+export declare const ZERO_TO_MAP_RECEIPT_SCHEMA: "honua.zero-to-map.receipt/v1";
+export declare const ZERO_TO_MAP_CONSOLE_RECEIPT_SCHEMA: "honua.zero-to-map.console-receipt/v1";
+export declare const ZERO_TO_MAP_CONSOLE_RECEIPT_REQUEST_SCHEMA: "honua.zero-to-map.console-receipt-request/v1";
+export declare const ZERO_TO_MAP_CATALOG_RECEIPT_SCHEMA: "honua.zero-to-map.catalog/v1";
+/**
+ * A server MCP profile whose members are additive to the default 432-tool base
+ * roster (47 static plus 385 `honua_admin_*` tools).
+ *
+ * The zero-to-map candidate must advertise `base` plus `analysis` plus
+ * `esri-gp`. Each profile is verified independently and the expected catalog
+ * total is derived by summing the base roster and the enabled profile rosters;
+ * it is never written down as a single magic number, so enabling or retiring a
+ * profile cannot silently disagree with the assertion.
+ */
+export interface ZeroToMapProfileRoster {
+    readonly id: string;
+    /** Tools this profile contributes on top of the base roster. */
+    readonly memberCount: number;
+    /**
+     * Members whose exact tool names are proven by an artifact in this
+     * repository (the checked-in Esri GP MCP contract and the journey plan).
+     * Any further members are counted, digested and reported, but deliberately
+     * not name-asserted: naming tools the server has never published would be a
+     * fabricated assertion rather than evidence.
+     */
+    readonly confirmedMembers: readonly string[];
+    /**
+     * Tool-name prefixes that attribute an advertised additive tool to this
+     * profile. A profile with no prefixes is the fallback bucket for additive
+     * tools that no other profile claims.
+     */
+    readonly namePrefixes: readonly string[];
+}
+/** Identifier of the always-required default roster. */
+export declare const ZERO_TO_MAP_BASE_PROFILE_ID = "base";
+/**
+ * Additive profiles the zero-to-map journey requires, in receipt order.
+ *
+ * `analysis` contributes six members; only `honua_buffer_features` - the
+ * MCP-native dataset Buffer verb the journey actually executes - is confirmed
+ * by an in-repo artifact. `esri-gp` contributes exactly the three tools named
+ * by `release/zero-to-map/contracts/esri-gp-mcp.v1.json`.
+ */
+export declare const ZERO_TO_MAP_ADDITIVE_PROFILES: readonly ZeroToMapProfileRoster[];
+/** Profiles the candidate must advertise before the journey is executable. */
+export declare const ZERO_TO_MAP_REQUIRED_PROFILES: readonly string[];
+/** Tools the base roster contributes: 47 static + 385 published Admin projections. */
+export declare const ZERO_TO_MAP_BASE_PROFILE_TOOL_COUNT: number;
+/** Derived candidate total. Never hardcode this; it follows from the enabled profiles. */
+export declare const ZERO_TO_MAP_EXPECTED_TOTAL_TOOL_COUNT: number;
+export interface ZeroToMapProfileReceipt {
+    readonly id: string;
+    readonly expectedMembers: number;
+    readonly advertisedMembers: number;
+    readonly confirmedMembers: readonly string[];
+    /**
+     * Advertised names this preflight can attribute to the profile. Empty-prefix
+     * profiles cannot be separated from the base static surface by name, so only
+     * their confirmed members appear here.
+     */
+    readonly nameResolvedMembers: readonly string[];
+    /** SHA-256 over the sorted advertised names this profile was verified against. */
+    readonly rosterSha256: string;
+}
+/** Catalog preflight evidence retained on the journey receipt. */
+export interface ZeroToMapCatalogReceipt {
+    readonly schemaVersion: typeof ZERO_TO_MAP_CATALOG_RECEIPT_SCHEMA;
+    readonly activeProfiles: readonly string[];
+    /** Derived: base roster plus every enabled additive profile roster. */
+    readonly expectedTotalTools: number;
+    readonly advertisedTotalTools: number;
+    readonly baseStaticTools: number;
+    readonly baseAdminTools: number;
+    readonly auditedExclusions: number;
+    readonly profiles: readonly ZeroToMapProfileReceipt[];
+    /** SHA-256 over every advertised tool name, sorted. */
+    readonly catalogSha256: string;
+    /** SHA-256 over the advertised `honua_admin_*` names, sorted. */
+    readonly adminRosterSha256: string;
+    /**
+     * SHA-256 over the advertised non-Admin names that no name-resolvable profile
+     * claimed, sorted. This is the base static surface plus the unnamed members
+     * of the fallback profile, which the server does not yet let us separate.
+     */
+    readonly staticRosterSha256: string;
+    /** Generated exclusion-roster digest the base roster was audited against. */
+    readonly exclusionRosterSha256: string;
+}
+export type JourneyActionKind = "cli" | "mcp" | "mcp-resource" | "gpserver" | "receipt" | "http";
+export type JourneyActionStatus = "passed" | "blocked" | "failed" | "skipped";
+export type JourneyStatus = "passed" | "blocked" | "failed";
+export type JourneyTarget = "local-docker" | "aws-ecs";
+export interface JourneyCapture {
+    readonly variable: string;
+    /** Candidate JSON pointers, checked in order. */
+    readonly pointers: readonly string[];
+    /** Optional pointer(s) within a JSON document stored at a candidate pointer. */
+    readonly parsedPointers?: readonly string[];
+    /** Optional contract value that the captured response must equal. */
+    readonly equals?: string | number | boolean;
+}
+interface JourneyActionBase {
+    readonly id: string;
+    readonly title: string;
+    readonly kind: JourneyActionKind;
+    readonly captures?: readonly JourneyCapture[];
+    /** Response fields that must remain absent (for example pre-approval public URLs). */
+    readonly forbiddenPointers?: readonly string[];
+}
+export interface JourneyCliAction extends JourneyActionBase {
+    readonly kind: "cli";
+    readonly args: readonly string[];
+}
+export interface JourneyMcpAction extends JourneyActionBase {
+    readonly kind: "mcp";
+    readonly tool: string;
+    readonly arguments: Readonly<Record<string, unknown>>;
+}
+export interface JourneyResourceWait {
+    /** JSON pointer inside the resource's JSON text body. */
+    readonly pointer: string;
+    /** The successful terminal value. */
+    readonly equals: string;
+    /** All terminal values; any terminal value other than equals fails immediately. */
+    readonly terminal: readonly string[];
+    readonly pollIntervalMs: number;
+    readonly deadlineMs: number;
+}
+/** Read or poll one MCP resource and retain the unmodified resources/read envelope. */
+export interface JourneyMcpResourceAction extends JourneyActionBase {
+    readonly kind: "mcp-resource";
+    readonly uri: string;
+    readonly waitFor?: JourneyResourceWait;
+}
+/**
+ * An Esri-compatible GPServer invocation through the SDK's unified process
+ * runner. Parameters stay schema-driven: the Buffer alias keeps Honua's
+ * advertised geometry.buffer parameter contract.
+ */
+export interface JourneyGpServerAction extends JourneyActionBase {
+    readonly kind: "gpserver";
+    readonly serviceId: string;
+    readonly taskName: string;
+    readonly processId: string;
+    readonly parameters: Readonly<Record<string, unknown>>;
+    readonly resultNames: readonly string[];
+}
+export interface JourneyReceiptAction extends JourneyActionBase {
+    readonly kind: "receipt";
+    readonly receiptSchema: string;
+    /** Receipt pointer -> journey template equality checks. */
+    readonly matches: Readonly<Record<string, string>>;
+    /** Receipt pointers that must resolve to non-empty identity/evidence values. */
+    readonly requiredPointers: readonly string[];
+    /** Pairs of receipt pointers whose values must be identical. */
+    readonly equalPointers?: readonly (readonly [string, string])[];
+}
+export interface JourneyHttpAction extends JourneyActionBase {
+    readonly kind: "http";
+    readonly url: string;
+    readonly expectedStatus: number;
+}
+export type JourneyAction = JourneyCliAction | JourneyMcpAction | JourneyMcpResourceAction | JourneyGpServerAction | JourneyReceiptAction | JourneyHttpAction;
+export interface JourneyStage {
+    readonly number: number;
+    readonly id: string;
+    readonly title: string;
+    readonly actions: readonly JourneyAction[];
+}
+export interface ZeroToMapPlan {
+    readonly schemaVersion: typeof ZERO_TO_MAP_PLAN_SCHEMA;
+    readonly journeyId: string;
+    readonly releaseContract: string;
+    readonly fixtures: readonly string[];
+    /** Traceable dependencies; these are not runtime blockers by themselves. */
+    readonly dependencyRefs: readonly string[];
+    readonly variables?: Readonly<Record<string, unknown>>;
+    readonly stages: readonly JourneyStage[];
+}
+export interface JourneyExecutionResult {
+    readonly value?: unknown;
+    /** Safe, non-secret evidence suitable for the release receipt. */
+    readonly evidence?: Readonly<Record<string, unknown>>;
+}
+export interface JourneyMcpToolDescriptor {
+    readonly name: string;
+    readonly inputSchema: Readonly<Record<string, unknown>>;
+}
+export interface JourneyAdapter {
+    runCli(args: readonly string[]): Promise<JourneyExecutionResult>;
+    listTools(): Promise<readonly JourneyMcpToolDescriptor[]>;
+    callTool(tool: string, args: Readonly<Record<string, unknown>>): Promise<JourneyExecutionResult>;
+    readResource(action: JourneyMcpResourceAction): Promise<JourneyExecutionResult>;
+    runGpServer(action: JourneyGpServerAction): Promise<JourneyExecutionResult>;
+    readReceipt(actionId: string): Promise<JourneyExecutionResult | undefined>;
+    checkHttp(url: string, expectedStatus: number): Promise<JourneyExecutionResult>;
+    close?(): Promise<void>;
+}
+export interface RunJourneyOptions {
+    /** Live mutations are refused unless this is explicitly true. */
+    readonly execute: boolean;
+    /** Selects the target-specific boundary for checkpoint-safe fixture inputs. */
+    readonly target?: JourneyTarget;
+    readonly variables?: Readonly<Record<string, unknown>>;
+    readonly now?: () => Date;
+    /** Previously completed live stages restored from a verified checkpoint. */
+    readonly resume?: JourneyResumeState;
+    /** Called only at the external Console receipt boundary, before later work is skipped. */
+    readonly onExternalReceiptMissing?: (snapshot: JourneyPauseSnapshot) => Promise<void> | void;
+}
+export interface JourneyActionReceipt {
+    readonly id: string;
+    readonly kind: JourneyActionKind;
+    readonly status: JourneyActionStatus;
+    readonly startedAt: string;
+    readonly finishedAt: string;
+    readonly code?: string;
+    readonly message?: string;
+    readonly evidence?: Readonly<Record<string, unknown>>;
+    readonly captures?: Readonly<Record<string, unknown>>;
+}
+export interface JourneyStageReceipt {
+    readonly number: number;
+    readonly id: string;
+    readonly title: string;
+    readonly status: JourneyActionStatus;
+    readonly actions: readonly JourneyActionReceipt[];
+}
+export interface JourneyResumePoint {
+    readonly stageId: string;
+    readonly actionId: string;
+}
+export interface JourneyReceiptRequest {
+    readonly schemaVersion: typeof ZERO_TO_MAP_CONSOLE_RECEIPT_REQUEST_SCHEMA;
+    readonly actionId: string;
+    readonly receiptSchema: string;
+    readonly matches: Readonly<Record<string, unknown>>;
+    readonly requiredPointers: readonly string[];
+    readonly equalPointers: readonly (readonly [string, string])[];
+}
+/** Secret-free execution state nested inside the CLI checkpoint. */
+export interface JourneyResumeState {
+    readonly startedAt: string;
+    readonly capturedVariables: Readonly<Record<string, unknown>>;
+    readonly completedStages: readonly JourneyStageReceipt[];
+    readonly resumeAt: JourneyResumePoint;
+    /**
+     * Catalog preflight evidence gathered before the pause.
+     *
+     * Every successful live journey pauses at the mandatory Console checkpoint
+     * and resumes at stage 6, and stages 6 and 7 contain no MCP action -- so the
+     * resumed run has nothing to re-derive this from. Without carrying it across
+     * the boundary the final receipt, which overwrites the pre-pause one, would
+     * silently drop the active-profile and roster-digest evidence from exactly
+     * the runs that succeeded.
+     */
+    readonly catalog?: ZeroToMapCatalogReceipt;
+}
+export interface JourneyPauseSnapshot extends JourneyResumeState {
+    readonly consoleReceiptRequest: JourneyReceiptRequest;
+}
+export interface ZeroToMapReceipt {
+    readonly schemaVersion: typeof ZERO_TO_MAP_RECEIPT_SCHEMA;
+    readonly journeyId: string;
+    readonly releaseContract: string;
+    readonly mode: "contract" | "live";
+    readonly status: JourneyStatus;
+    readonly startedAt: string;
+    readonly finishedAt: string;
+    readonly dependencyRefs: readonly string[];
+    /** Runtime blocking receipts only. Always empty when status is passed. */
+    readonly blockers: readonly string[];
+    /** Catalog preflight evidence: active profiles and roster digests. Live mode only. */
+    readonly catalog?: ZeroToMapCatalogReceipt;
+    readonly stages: readonly JourneyStageReceipt[];
+}
+export declare class JourneyBlockedError extends Error {
+    readonly code: string;
+    constructor(message: string, code?: string);
+}
+/** Parse and validate the checked-in release plan without executing it. */
+export declare function parseZeroToMapPlan(value: unknown): ZeroToMapPlan;
+/**
+ * Run a plan, recording every blocked/skipped step. Contract mode never calls
+ * the adapter and therefore cannot be mistaken for a live release execution.
+ */
+export declare function runZeroToMapJourney(plan: ZeroToMapPlan, adapter: JourneyAdapter, options: RunJourneyOptions): Promise<ZeroToMapReceipt>;
+/**
+ * Validate that a checkpoint contains exactly the passed stage prefix for this
+ * plan. Returning the resume stage index lets the executor preserve the prior
+ * receipts without replaying any mutating action.
+ */
+export declare function validateJourneyResume(plan: ZeroToMapPlan, resume: JourneyResumeState, executionVariables?: Readonly<Record<string, unknown>>, target?: JourneyTarget): number;
+export {};
+//# sourceMappingURL=zero-to-map.d.ts.map

package/dist/src/release/zero-to-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zero-to-map.d.ts","sourceRoot":"","sources":["../../../src/release/zero-to-map.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,uBAAuB,EAAG,2BAAoC,CAAC;AAC5E,eAAO,MAAM,0BAA0B,EAAG,8BAAuC,CAAC;AAClF,eAAO,MAAM,kCAAkC,EAAG,sCAA+C,CAAC;AAClG,eAAO,MAAM,0CAA0C,EAAG,8CAAuD,CAAC;AAClH,eAAO,MAAM,kCAAkC,EAAG,8BAAuC,CAAC;AAE1F;;;;;;;;;GASG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,wDAAwD;AACxD,eAAO,MAAM,2BAA2B,SAAS,CAAC;AAElD;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,sBAAsB,EAa1E,CAAC;AAEF,8EAA8E;AAC9E,eAAO,MAAM,6BAA6B,EAAE,SAAS,MAAM,EAG1D,CAAC;AAEF,sFAAsF;AACtF,eAAO,MAAM,mCAAmC,QACuB,CAAC;AAExE,0FAA0F;AAC1F,eAAO,MAAM,qCAAqC,QAEwC,CAAC;AAE3F,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,kFAAkF;IAClF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,kEAAkE;AAClE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,aAAa,EAAE,OAAO,kCAAkC,CAAC;IAClE,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,uEAAuE;IACvE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,SAAS,uBAAuB,EAAE,CAAC;IACtD,uDAAuD;IACvD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,6EAA6E;IAC7E,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;CACxC;AAmBD,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,KAAK,GAAG,cAAc,GAAG,UAAU,GAAG,SAAS,GAAG,MAAM,CAAC;AACjG,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAC9E,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;AAC5D,MAAM,MAAM,aAAa,GAAG,cAAc,GAAG,SAAS,CAAC;AAEvD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,gFAAgF;IAChF,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;CAC7C;AAED,UAAU,iBAAiB;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC9C,sFAAsF;IACtF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD;AAED,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,mBAAmB;IAClC,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qCAAqC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,uFAAuF;AACvF,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IACjE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAsB,SAAQ,iBAAiB;IAC9D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,oBAAqB,SAAQ,iBAAiB;IAC7D,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;CACjE;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,MAAM,aAAa,GACrB,gBAAgB,GAChB,gBAAgB,GAChB,wBAAwB,GACxB,qBAAqB,GACrB,oBAAoB,GACpB,iBAAiB,CAAC;AAEtB,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;CAC5C;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,aAAa,EAAE,OAAO,uBAAuB,CAAC;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,4EAA4E;IAC5E,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjE,SAAS,IAAI,OAAO,CAAC,SAAS,wBAAwB,EAAE,CAAC,CAAC;IAC1D,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjG,YAAY,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAChF,WAAW,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC5E,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC;IAC3E,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAChF,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IACrC,0FAA0F;IAC1F,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC,QAAQ,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC9F;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,aAAa,EAAE,OAAO,0CAA0C,CAAC;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,aAAa,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;CAChE;AAED,oEAAoE;AACpE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,QAAQ,CAAC,eAAe,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACzD,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC;;;;;;;;;OASG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,uBAAuB,CAAC;CAC5C;AAED,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAC9D,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;CACvD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,aAAa,EAAE,OAAO,0BAA0B,CAAC;IAC1D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,sFAAsF;IACtF,QAAQ,CAAC,OAAO,CAAC,EAAE,uBAAuB,CAAC;IAC3C,QAAQ,CAAC,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACjD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAG1C,QAAQ,CAAC,IAAI;gBADb,OAAO,EAAE,MAAM,EACN,IAAI,SAA2B;CAK3C;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CA0ChE;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,gBAAgB,CAAC,CA8J3B;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,kBAAkB,EAC1B,kBAAkB,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAM,EAC1D,MAAM,GAAE,aAA8B,GACrC,MAAM,CAiHR"}